CVE-2026-127029

Name of the Vulnerable Software and Affected Versions freeradius (affected versions not specified)

Description A flaw exists in the Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. The server copies a client-supplied identity into an internal structure without properly validating its length against a fixed-size buffer. An unauthenticated remote attacker can send specially crafted EAP-SIM messages to trigger a stack buffer overflow, which crashes the service and leads to a Denial of Service (DoS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.